# Agent Instruction Security Scanner

Canonical tool: https://repoagentkit.com/agent-instruction-security-scanner

Repo Agent Kit scans supported coding-agent instruction files in a public GitHub repository before an agent reads or executes their guidance. Enter `owner/repository` or a canonical `github.com` URL.

The browser recursively discovers up to 40 instruction files, including:

- `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md`
- `.cursorrules` and `.cursor/rules/*.md` or `*.mdc`
- `.github/copilot-instructions.md` and `.github/instructions/*.instructions.md`
- `.claude/rules/*.md` and `.windsurf/rules/*.md`

The static screen looks for eight bounded review signals: invisible or bidirectional Unicode controls, downloads piped into interpreters, secret-transfer instructions, approval or sandbox bypasses, remote content treated as authoritative instructions, destructive commands, broad sensitive-file access, and encoded or dynamically evaluated payloads.

No repository code is executed. The visitor's browser reads GitHub's public REST API directly; Repo Agent Kit does not proxy or store repository names or file contents. Analytics records only a bounded action label for running, copying, or sharing a scan or copying an install command.

## Local CLI

Run the reviewed v1.1.2 release directly from GitHub without a global install, account, token, or dependency installation:

```bash
npx --yes github:sunxiayi/repo-agent-instruction-security-scan#v1.1.2 .
```

The zero-dependency CLI prints line-level findings and fails on high severity by default. It can scan named paths, use `--fail-on medium`, `low`, or `none`, and write text, JSON, or SARIF 2.1.0. The same repository includes a pre-commit hook. It makes no network request during scanning and executes none of the instruction content it reads.

### Downloadable package

The versioned npm-compatible package can also be [downloaded directly](https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.1.2/repo-agent-instruction-security-scan-1.1.2.tgz) or installed globally from its release asset:

```bash
npm install --global https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.1.2/repo-agent-instruction-security-scan-1.1.2.tgz
```

Install the validated pre-commit hook from the immutable release tag:

```yaml
repos:
  - repo: https://github.com/sunxiayi/repo-agent-instruction-security-scan
    rev: v1.1.2
    hooks:
      - id: repo-agent-instruction-security-scan
```

SHA-256: `e99ad514e8c03aa82eb5bdf6213eb8cf1d75c1426e0ccd377e1643e7d236ea9c`

## GitHub Action

The same eight checks are available as the zero-dependency [`sunxiayi/repo-agent-instruction-security-scan`](https://github.com/sunxiayi/repo-agent-instruction-security-scan) GitHub Action. Add it after checkout to review supported instruction files on every pull request:

```yaml
permissions:
  contents: read

steps:
  - uses: actions/checkout@v6
  - uses: sunxiayi/repo-agent-instruction-security-scan@v1
```

The Action runs on Node 24, makes no network calls, requires no token or dependency install, adds line-level annotations and a job summary, and writes machine-readable JSON and SARIF 2.1.0 reports. It fails on high-severity findings by default; `fail-on` can be set to `medium`, `low`, or `none`.

## Interpretation boundary

A finding is a deterministic review prompt, not proof that a repository or maintainer is malicious. Legitimate maintenance guidance can match a pattern. A clean result is not a security guarantee: static patterns cannot establish provenance, inspect every referenced artifact, or validate runtime permission and network controls.

Primary references:

- Claude Code secure deployment: https://code.claude.com/docs/en/agent-sdk/secure-deployment
- VS Code custom instruction discovery: https://code.visualstudio.com/docs/agent-customization/custom-instructions
- Snyk Agent Scan source and risk categories: https://github.com/snyk/agent-scan
- AgentSecBench: https://arxiv.org/abs/2605.26269